+1.877.796.2559 | Investors|

April 2017 Privacy Summary

By Nicolas Dufour | May 1, 2017 | Privacy Summary

Federal Developments

Confidentiality and Release of Information Under the DOT Drug and Alcohol Testing Process
It is hard enough hiring a new driver and making sure that everything is in line with the expansive list of Federal Regulations and your company hiring requirements, but it is just as important that your safety department understand the issues regarding what is necessary to access driver “consumer reports.” As we all know, a DOT drug test is often mandatory for transportation employees, across all modes of transportation. Typically, a new hire is asked if they have been drug tested in the past, if they have ever failed a drug test, and given a form to sign stating that it is okay for this new employer to request all their test results from other employers. At first blush, this seems quite harmless and definitely makes it a little easier on the paperwork load. However, a closer look at the law governing DOT drug and alcohol testing is pretty clear that a “blanket release” is prohibited. You must get the person’s written consent to seek the information from other employers; this means you need “specific written consent.” The person must list all previous and current employers within the relevant time period. The language on the release must be a specific release authorizing your company to receive testing information from a specific or current employer about that specific employee. For example, the release document should not have multiple employers listed, it should have one employer for one employee at a specific point in time. This consent cannot be part of another DOT requirement like a motor vehicle check or criminal background check. With the approach of the new Drug and Alcohol Clearinghouse, it is important to start examining your procedures and forms now. Remember, the Drug and Alcohol Clearinghouse will be an annual process and, unless the FMCSA changes its regulations, the waiver/release form must be signed each year
http://www.lexology.com/library/detail.aspx?g=0b0c96c8-7853-452f-bc51-02a0c321e820&utm_source=Lexology+Daily+Newsfeed&utm_medium=HTML+email+-+Body+-+General+section&utm_campaign=ACC+Newsstand+subscriber+daily+feed&utm_content=Lexology+Daily+Newsfeed+2017-04-06&utm_term

FTC Approves Final Orders
On April 14th, the FTC announced that it approved final orders with three companies for allegedly deceiving customers by misrepresenting their participation in the Asia-Pacific Economic Cooperation (APEC) Cross-Border Privacy Rules (CBPR) system. The APEC CBPR system facilitates cross-border data flows between APEC member countries through a voluntary, enforceable mechanism. According to the original complaint, Sentinel Labs Inc., SpyChatter Inc., and Vir2us Inc. falsely represented in their online privacy policies that they participated in the CBPR system, in violation of the FTC Act. Under the settlement, the Companies are prohibited from misrepresenting their participation, membership, or certification in any privacy or security program sponsored by a government or self-regulatory or standard-setting organization.
https://www.ftc.gov/news-events/press-releases/2017/04/ftc-approves-final-orders-resolving-allegations-companies

Court Cases

EEOC Wins Round in Discrimination Case Against Dollar General
A federal judge ruled that the Equal Employment Opportunity Commission has met the requirements to move ahead with a discrimination lawsuit it filed against Dollar General in 2013, reports the Chicago Tribune. The EEOC argued that Dollar General’s practice of basing hiring decisions on a job candidate’s criminal history has a disparate impact on African-American job applicants, says the Tribune. The discount retailer fired a stocker and cashier a few days after hiring her when a background check uncovered a misdemeanor charge and a six-year-old drug-possession conviction, which she had revealed to the retailer during the recruitment process. Dollar General’s defense was that the EEOC didn’t give it enough notice about the alleged discrimination and moved ahead quickly with a lawsuit before giving the company a chance to improve its practices. But U.S. District Judge Andrea Wood disagreed and ruled in the EEOC’s favor.
http://www.hrdive.com/news/eeoc-wins-round-in-discrimination-case-against-dollar-general/440486/

D.C. Court Certifies Three Classes In Race Discrimination Class Action Involving Criminal Background Policy
In a class action alleging that the criminal background policy of Washington D.C.’s local transit authority had a disparate impact on African-Americans, a federal district court recently certified three classes of African-American employees and applicants despite the employer’s workforce being 75% African-American. The ruling – in Little v. Washington Metropolitan Area Transit Authority, No. 14-1289, 2017 U.S. Dist. LEXIS 48637 (D.D.C. Mar. 31, 2017), is a “must read” for employers that use hiring screens. One of the hottest areas in workplace class actions involves criminal background checks used by employers. On one end of the spectrum, employers want to be sure they are not subjecting their businesses, employees, and clients to any potential criminal conduct by their own workers. On the other hand, many prospective employees with criminal backgrounds may have been adequately rehabilitated through the criminal justice system and merely need an opportunity to prove they can be counted on as an employee. In Little v. Washington Metropolitan Area Transit Authority, No. 14-1289, 2017 U.S. Dist. LEXIS 48637 (D.D.C. Mar. 31, 2017), Plaintiffs alleged that a criminal background check policy used by the Washington Metropolitan Area Transit Authority (“WMATA”) to screen candidates and employees was facially neutral, but had a disparate impact on African-Americans
http://www.lexology.com/library/detail.aspx?g=878fe260-1f8f-4c15-9cfa-556c4e9ff0eb

Is Hiring the Most-Qualified Candidate Reasonable? Two Recent Decisions Say Yes.
Many employers post all open positions at their facilities and allow all qualified employees to bid on any job they desire. This allows the company to hire the right employee into the right position, and allows everyone to know that promotions and job opportunities are decided by merit. These bidding policies help the employer promote open and fair policies, and they promote efficiency, performance, and trust in the workforce. However, in recent years, the EEOC has challenged these policies, alleging that they discriminate against disabled employees. According to the EEOC, employers must automatically place even a minimally-qualified disabled employee into an open position as a reasonable accommodation, even if the employer would otherwise open the position to bidding by all employees and even if there are other better-qualified candidates who are interested in the job. The EEOC’s position has naturally caused significant concern for many employers with open bidding policies. Fortunately, two recent decisions reinforce the right of employers to hire the best candidate for the job. In December, the Eleventh Circuit Court of Appeals held that “the ADA only requires an employer to allow a disabled person to compete equally with the rest of the world for a vacant position” and does not require the employer to automatically reassign an employee without competition. In that case, EEOC v. St. Joseph’s Hospital, Inc., the plaintiff was employed as a clinical nurse in the hospital’s psychiatric ward. The plaintiff developed spinal stenosis, for which she required the use of a cane. St. Joseph’s had significant safety concerns related to the presence of a cane in the psychiatric ward, and eventually determined that it was too dangerous to allow a cane in the ward. The hospital gave the plaintiff 30 days to bid on another position at the hospital. Although there were over 700 positions available, the plaintiff waited three weeks to apply for any jobs at all, and ultimately only applied for three jobs within the 30-day time period. She was not hired for any of the positions and eventually was terminated. Following a jury trial, the EEOC argued on appeal that the ADA requires reassignment without competing against non-disabled employees. The Eleventh Circuit ruled against the EEOC. The Court outlined a multi-part test to determine whether the requested accommodation—automatic reassignment to an open position without competing against non-disabled employees—was reasonable:

  1. The plaintiff must show that his or her requested accommodation is reasonable on its face, i.e., “ordinarily or in the run of cases.”
  2. If the plaintiff does so, the burden shifts to the employer to show that granting the accommodation would impose an undue hardship under the facts of the particular case.
  3. If the plaintiff does not carry his or her burden at step one, the plaintiff can still prevail, provided he or she can show that there are special circumstances in that particular case making the accommodation reasonable.

The Eleventh Circuit affirmatively found that “[r]equiring reassignment in violation of an employer’s best-qualified hiring or transfer policy is not reasonable ‘in the run of cases.’” Consequently, the Court found that where the employer has a merits-based selection policy, the ADA only requires the employer to allow a disabled person to compete equally for a vacant position. And in that case, given that the plaintiff had not attempted to show any special circumstances that warranted requiring the hospital to ignore its best-qualified hiring policy, the Court found that the hospital had not violated the ADA by requiring the plaintiff to bid for an open position.

In March, in EEOC v. Methodist Hospitals of Dallas, the Northern District of Texas was faced with an almost identical fact pattern. There, the Court noted that the Fifth Circuit had not directly addressed the issue, but found that “the weight of Fifth Circuit authority holds that the ADA does not entitle a disabled employee to preferential treatment.” In making its holding, the Court adopted the reasoning in the Eleventh Circuit’s St. Joseph’s Hospital decision in full, and held that Methodist’s policy of requiring disabled employees to compete with non-disabled applicants in order to hire the best candidate does not violate the ADA.

Taken together, these two recent decisions should provide comfort to employers with open bidding policies. However, employers should be aware that despite these set-backs, the EEOC is not likely to agree that open bidding policies comport with the ADA. The federal courts have not yet agreed uniformly on this issue, and the EEOC consistently cites to cases out of the Seventh Circuit, the Tenth Circuit, and the D.C. Circuit to support its position. Although these cases have been distinguished by the Eleventh Circuit and the Northern District of Texas, employers in those districts should be especially alert when dealing with reassignment requests from disabled employees. In addition, whenever presented with a request for accommodation, employers should not jump to any conclusions or make any rash decisions. It is always a best practice to refer all disability claims to HR, go through the interactive process, stay in communication with the disabled employee, and, above all, document, document, document. Fortunately, these decisions strengthen employers’ ability to maintain merits-based selection policies, and will help companies continue to hire the right employee into the right position.
http://www.lexology.com/library/detail.aspx?g=804ce3dd-ebc5-41e7-a85e-b4f12c0c4225&utm_source=Lexology+Daily+Newsfeed&utm_medium=HTML+email+-+Body+-+General+section&utm_campaign=ACC+Newsstand+subscriber+daily+feed&utm_content=Lexology+Daily+Newsfeed+2017-04-20&utm_term

Liability Waiver in Pre-Employment Disclosure Form is Unlawful, Says Ninth Circuit
In Syed v. M-I, LLC, the U.S. Court of Appeals for the Ninth Circuit recently held that a prospective employer violated the disclosure requirements of the Fair Credit Reporting Act (FCRA) by including a liability waiver in a job applicant’s pre-employment form. The provision of the FCRA at issue – 15 U.S.C. § 1681b(b)(2)(A) – requires prospective employers to disclose “in a document that consists solely of that disclosure” that they may obtain a job applicant’s consumer report as part of the employment application process, and provide the means by which the prospective employee might withhold such authorization. (Emphasis added.) Syed, a job applicant, was provided a disclosure release form as part of his application to M-I. Along with providing the required disclosure pursuant to the statute, the form included an additional liability waiver, which stipulated that, by signing the document, Syed was waiving his rights to sue M-I and its agents for violations of the FCRA. The Ninth Circuit ruled that this simultaneous inclusion of the liability waiver was unlawful because the statute “unambiguously” required that the form only contain the disclosure without additional terms, such as a liability waiver. Because this language was so clear, the court determined M-I’s inclusion of the waiver was made in “reckless disregard of its statutory duty.” This finding of a willful violation subjected M-I to statutory damages, punitive damages, and attorney’s fees and costs. In light of the Ninth Circuit’s ruling, employers should be aware that when it comes to making statutory disclosures under the FCRA’s § 1681b(b)(2)(A) in pre-employment applications, form over substance matters – and employers may be best served by including separate forms for additional disclosures.
http://www.lexology.com/library/detail.aspx?g=3f73782d-3b1d-44ed-b52b-5cd29875c353&utm_source=Lexology+Daily+Newsfeed&utm_medium=HTML+email+-+Body+-+General+section&utm_campaign=ACC+Newsstand+subscriber+daily+feed&utm_content=Lexology+Daily+Newsfeed+2017-03-31&utm_term

Applicant Who Failed Pre-Employment Drug Test Could Not Show That Public Employer Violated Her Due Process Rights or Title VII
A federal district court recently dismissed a lawsuit in which a job applicant challenged a public employer’s decision to withdraw an offer of employment after the individual tested positive for cocaine on a pre-employment drug test. Turner v. Richmond Public Schools, et al., No. 3:16-cv-256 (E.D.VA., March 28, 2017). The federal action sought to recover damages for (1) the violation of Plaintiff’s Due Process rights under the Fourteenth Amendment to the United States Constitution; and (2) disparate treatment based on race and gender in violations of Title VII. Plaintiff, an African American female, applied for a position as an Instructional Data Specialist with Defendant Richmond Public Schools. After receiving a conditional offer of employment, Plaintiff submitted a urine sample for drug and alcohol screening; the test returned positive for cocaine. Based on the test results, Richmond Public Schools rescinded Plaintiff’s offer of employment. Plaintiff requested reconsideration of the decision based on her concerns with the drug test procedures, disparate treatment between Plaintiff and other employees who had tested positive for drugs, and the lack of due process afforded to Plaintiff. To state a viable due process claim, Plaintiff was required to show that she had a constitutionally protected liberty or property interest. Plaintiff ultimately failed to state sufficient facts reasonably to claim that she held any liberty or property interest at issue in the action. The District Court determined that the conditional offer of employment could not support Plaintiff’s claim of entitlement to employment because Plaintiff had no reasonable expectation of entitlement to the job at the time Richmond Public Schools rescinded the employment offer. Additionally, the District Court found that Plaintiff failed to state a claim under the “stigma-plus” standard, set forth by the U.S. Supreme Court in Paul v. Davis, 424 U.S. 693 (1976), necessary to establish a deprivation of liberty within the meaning of the Due Process Clause. The District Court explained that Plaintiff failed to identify any false statements made by Richmond Public Schools that placed a stigma on Plaintiff’s reputation and that were made in conjunction with Richmond Public Schools’ determination to rescind the employment offer. Similarly, the District Court determined that Plaintiff’s complaint lacked specific factual allegations sufficient to state a claim for race or gender discrimination under Title VII. Plaintiff alleged that there were instances in which white male employees tested positive for drugs but were not terminated. The District Court distinguished Plaintiff’s situation, however, from white male employees because Plaintiff was not yet an employee at the time of her drug test and, thus, could not compare herself to employees of Richmond Public Schools who may have tested positive for drugs. The District Court also found that Plaintiff failed to identify any facts indicating that she and her comparators dealt with the same supervisors, were subject to the same standards or performed the same functions for the employer. For the reasons stated, the District Court dismissed Plaintiff’s action in its entirety. Notably, Plaintiff did not assert a claim that the drug test constituted an unlawful search and seizure in violation of the Fourth Amendment, which is the most common claim asserted against public employers in the drug testing context.
http://www.lexology.com/library/detail.aspx?g=2179a77a-ec4e-4f89-a1d5-2c252567399e&utm_source=Lexology+Daily+Newsfeed&utm_medium=HTML+email+-+Body+-+General+section&utm_campaign=ACC+Newsstand+subscriber+daily+feed&utm_content=Lexology+Daily+Newsfeed+2017-04-12&utm_term

FCRA Case
On April 12th, Plaintiff Bobby Dutta filed his opening brief with the U.S. Court of Appeals for the Ninth Circuit in a Fair Credit Reporting Act (FCRA) case alleging that State Farm misused applicants’ credit reports. According to the original complaint, Dutta alleged that he applied for an insurance agent position with the Company and was denied employment, but was not given the opportunity to review his report and mitigate concerns before he was Published by the Privacy and Consumer Regulatory Practice | Washington, DC Office April 17, 2017 Daily Privacy & Consumer Regulatory Alert Atlanta v Washington DC 2 denied the position, in violation of the FCRA. Dutta claims that the report contained inaccuracies that he was unable to resolve. In November 2016, a lower court awarded summary judgement to State Farm and denied Dutta’s proposed class-action lawsuit saying that the Plaintiff did not have standing to sue under the Supreme Court’s Spokeo v. Robins decision, and that the varied experiences of the class meant that it could not survive as a class-action. However, Dutta alleges that he did suffer harm because State Farm failed to provide him with his consumer report which was used to deny him employment in a timely manner. The case is Bobby Dutta v. State Farm Insurance Company, case number 16-17216, in the U.S. Court of Appeals for the Ninth Circuit.
https://dlbjbjzgnk95t.cloudfront.net/0913000/913012/https-ecf-ca9-uscourts-gov-n-beam-servlet-transportroom-servlet-showdoc-009028942615.pdf

CoreLogic Battles Renewed Class Cert. Bid In Records Row
CoreLogic National Background Data LLC blasted a renewed bid for class certification in Virginia federal court litigation alleging the criminal record data provider harmed job applicants by misattributing others’ crimes to them, arguing Thursday that the proposed class is based on arguments the court already rejected and requires individual inquiries. U.S. District Judge Robert Payne previously denied Tyrone Henderson and James Hines’ bid to certify a nationwide class and their request to certify a slimmer class fares no better, NBD argued.
https://www.law360.com/privacy/articles/913630/corelogic-battles-renewed-class-cert-bid-in-records-row?nl_pk=b14f4c91-6e5c-4e22-832d-ef92edafbeed&utm_source=newsletter&utm_medium=email&utm_campaign=privacy

The City of Philadelphia Has Agreed to Stay The Enforcement of The Philadelphia Wage Equity Ordinance Pending Resolution of Court Challenge
The City of Philadelphia has agreed to stay the enforcement of the Philadelphia Wage Equity Ordinance, which was to take effect on May 23, 2017, and be codified in the Philadelphia Code at Sections 9-1103((1)(i) and 9-1131. The Ordinance has generated controversy because it bans employers who do business in Philadelphia from asking prospective employees about their wage or benefits history. On April 6, 2017, the Chamber of Commerce for Greater Philadelphia filed a lawsuit in the United States District Court for the Eastern District of Pennsylvania seeking declaratory and injunctive relief to prevent the City of Philadelphia and the Philadelphia Commission on Human Relations from enforcing the Ordinance. The suit alleges that while the Chamber supports the goal of eliminating gender-based wage discrimination, the Ordinance fails to advance that goal. Instead, the Ordinance takes an ineffective, roundabout and over-inclusive approach that: (1) violates the First Amendment by chilling protected speech of employers and impairing their ability to make informed hiring decisions, (2) violates the Due Process clause by imposing severe penalties for violation of vague provisions, e.g. “knowing and willing disclosure” and a definition of “employer” that would apply beyond the City limits and Pennsylvania borders, (3) violates the Commerce Clause by having extraterritorial effect that burdens interstate commerce, and (4) violates the Pennsylvania Constitution and Home Rule Act by regulating individuals who neither live nor work in the City of Philadelphia. Several days after filing the suit, the Chamber filed a motion for preliminary injunction.

At a scheduling conference earlier this week with Judge Mitchell Goldberg, the City agreed to stay enforcement of the Ordinance pending resolution of the motion for preliminary injunction. Based on this agreement, the Court issued an Order staying the enforcement of the Ordinance. The Court will first consider the City’s forthcoming motion contesting the Chamber’s standing to bring the case, which will be fully briefed by May 12, 2017. If the case proceeds, the Court will set a briefing schedule to resolve the Chamber’s motion for preliminary injunction. For a detailed discussion of the Ordinance, see Denise Maher and Martha Keon, The Philadelphia Wage Equity Bill Will Ban Employers From Asking Prospective Employees About Their Past Wages and Fringe Benefits, Littler Insight (Oct. 24, 2016); and Martha Keon and Denise Maher, Philadelphia’s Wage Equity Bill Set To Go Into Effect On May 23, 2017, Littler ASAP (Jan. 25, 2017).
http://www.lexology.com/library/detail.aspx?g=e814b5c3-2422-411a-9917-d3dbc8b9f41e&utm_source=Lexology+Daily+Newsfeed&utm_medium=HTML+email+-+Body+-+General+section&utm_campaign=ACC+Newsstand+subscriber+daily+feed&utm_content=Lexology+Daily+Newsfeed+2017-04-24&utm_term

Refusal to Rescind Employee’s Resignation Not an Adverse Employment Action
Ruth Featherstone claimed that she suffered a temporary disability from an adverse drug reaction that altered her mental state. While in an altered state, she orally resigned from her position with Southern California Permanente Medical Group. At SCPMG’s request, Featherstone confirmed her resignation in writing. SCPMG then processed and completed Featherstone’s voluntary termination paperwork on the day of her resignation. A few days thereafter, Featherstone asked SCPMG to rescind her resignation. SCPMG declined to do so. Featherstone sued SCPMG on a claim that its refusal to rescind her resignation was a discriminatory act forbidden by the Fair Employment and Housing Act and public policy. The trial court granted SCPMG’s motion for summary judgment and Featherstone appealed. The Court of Appeal affirmed summary judgment for SCPMG on two independent grounds. First, the refusal to allow Featherstone to rescind her resignation was not an adverse employment action. To establish a prima facie case for disparate treatment discrimination, a FEHA plaintiff must establish that (1) she suffers from a disability, (2) she is otherwise qualified to do her job, (3) she suffered an adverse employment action, and (4) the employer harbored discriminatory intent. As to element (3), the Court of Appeal held that “refusing to allow a former employee to rescind a voluntary discharge—that is, a resignation free of employer coercion or misconduct—is not an adverse employment action.” This result followed from analogous federal law—the ADA and Title VII—which courts have interpreted to mean that an employer’s refusal to allow an employee to rescind a resignation is not an adverse employment action. The Court of Appeal further noted that SCPMG did not coerce Featherstone’s resignation and was not contractually obligated to permit rescission of her resignation. Second, the Court of Appeal also found that Featherstone failed to raise a triable issue of fact as to whether those who accepted and processed her resignation knew of her alleged disability when they took those actions. Featherstone holds that refusing to rescind a resignation that is voluntary and non-coerced is not an adverse employment action under FEHA. Featherstone will prove useful in defending claims by plaintiffs that involve similar employer actions that do not clearly qualify as adverse employment actions under California law. Featherstone also highlights the importance of promptly accepting and processing employee resignations.
http://www.lexology.com/library/detail.aspx?g=a745eee4-0c1e-4c1f-ba3a-56b1267ed1e0&utm_source=Lexology+Daily+Newsfeed&utm_medium=HTML+email+-+Body+-+General+section&utm_campaign=ACC+Newsstand+subscriber+daily+feed&utm_content=Lexology+Daily+Newsfeed+2017-04-24&utm_term

State Developments

Virginia Adds State Income Tax Provision to Data Breach Notification Law
Recently, Virginia passed an amendment to its data breach notification law that adds state income tax information to the types of data that require notification to the Virginia Office of the Attorney General in the event of unauthorized access and acquisition of such data. Under the amended law, an employer or payroll service provider must notify the Virginia Office of the Attorney General after the discovery or notification of unauthorized access and acquisition of unencrypted and un-redacted computerized data containing a Virginia resident’s taxpayer identification number in combination with the income tax withheld for that taxpayer. The amendment contains a harm threshold, requiring notification when such unauthorized access and acquisition compromises the confidentiality of the data and causes, or reasonably will cause, identity theft or fraud. For employers, the amendment applies only to the employer’s Virginia employees, and not to information regarding the employer’s customers or non-employees. Notification to the Virginia Office of the Attorney General must be made “without unreasonable delay” and must include the name and federal employer identification number of the employer that may be affected by the incident. The amendment requires notification only to the Virginia Office of the Attorney General, and not affected individuals. The amendment takes effect on July 1, 2017.
http://www.lexology.com/library/detail.aspx?g=499e709a-1bbe-437f-961e-ad92da9549a1&utm_source=Lexology+Daily+Newsfeed&utm_medium=HTML+email+-+Body+-+General+section&utm_campaign=ACC+Newsstand+subscriber+daily+feed&utm_content=Lexology+Daily+Newsfeed+2017-04-06&utm_term

The Trend Continues: NYC Passes Salary History Ban
In a move anticipated for months, and a day after Equal Pay Day, the New York City Council approved a salary history “ban” making it illegal for any employer or employment agency in New York City to inquire about a job applicant’s salary history and employee benefits in the interview process. The bill was first introduced on August 16, 2016, in an attempt to prohibit employers from inquiring about a prospective employee’s salary history on a job application. The proposed bill closely followed a provision from Massachusetts’ amendments to its Equal Pay Act (and similar provisions in Philadelphia), which prohibit employers operating in those states from requesting the compensation history of prospective employees, unless the prospective employee has “voluntarily” disclosed such information.
On Wednesday, April 5, 2017, after months of debate and public comment, the New York City Council approved the passage of the bill. The bill formally amends the New York City Human Rights Law, Title 8 of the Administrative Code of the City of New York, which prohibits discrimination in New York City. 1253-A now makes it a discriminatory employment practice for an employer to:

  1. inquire about the salary history of an applicant for employment, which includes either asking the applicant directly about his or her salary history or conducting a search of publicly available records or reports; or
  2. rely on the salary history of an applicant in determining that applicant’s salary at any stage in the employment process, unless the applicant “unprompted” and “willingly” discloses his or her prior salary information.

The law applies to all employers, both public and private. It is slated to go into effect 180 days after it is signed. We expect that it will be signed by Mayor de Blasio without delay, which would put the implementation in October 2017.

Proponents of the law champion it as a way to eliminate the “pay gap,” arguing that an employer’s use of an applicant’s previous salary history could lead to gender-based wage discrimination under the theory that applicants would be paid based on their past earnings, rather than what they would be offered if judged on a blank slate. Many others criticize the bill because they believe that it will not eliminate any wage gap but will instead create greater reliance on salary negotiation.

The New York City Commission on Human Rights, the agency charged with ferreting out discrimination in the five boroughs, will be enforcing the new law. The commission will impose a civil penalty of up to $125 for an intentional violation, and up to $250,000 for an “intentional malicious violation.” Introduction 1253-A also comes off the heels of two other significant pieces of New York legislation. On November 4, 2016 Mayor Bill de Blasio signed Executive Order 21 that bans questions regarding an applicant’s salary history prior to conditional employment. Importantly, this only applied to public-sector applicants. Introduction 1253-A therefore closes the gap. On January 9, 2017, Governor Andrew Cuomo approved Executive Order 161, also in an effort to ensure pay equity by State employers. The Order prohibits State entities from asking or mandating an applicant to “provide his or her current compensation, or any prior compensation history,” before offering a conditional offer of employment with compensation. The concern is that, due to the identifiable wage gap between men and women, asking about previous salary history sets an unconscious line in the sand as a starting place for candidates, thus perpetuating the discrimination. This development certainly follows the trend of the pay-equity movement taking place in cities and states nationwide. In light of the City’s new focus on prior salary history information, employers should be mindful of these new restrictions and evaluate how the new legislation may impact their practices. We are tracking these efforts in the 50-State Desktop Pay Equity Reference, which was released earlier this week.
http://www.lexology.com/library/detail.aspx?g=ddc78318-1137-4758-bc81-340d5005cf5c&utm_source=Lexology+Daily+Newsfeed&utm_medium=HTML+email+-+Body+-+General+section&utm_campaign=ACC+Newsstand+subscriber+daily+feed&utm_content=Lexology+Daily+Newsfeed+2017-04-10&utm_term

Enacted State Legislation
Nine states’ legislative sessions have concluded. Examples of privacy and data security legislation that has been enacted includes:

Asking About or Using Employee Credit Information Is an Unlawful Employment Practice in D.C.
Effective April 7, 2017, pursuant to the new Fair Credit in Employment Amendment Act of 2016 (the “Act”), an amendment to the D.C. Human Rights Act, most D.C. employers are now prohibited from requesting or utilizing a current or prospective employee’s credit information. A violation of the Act will be considered an unlawful discriminatory practice and may subject offending employers to a fine imposed by the D.C. Commission on Human Rights or a private cause of action.

The law eliminates a covered employer’s ability, during both the hiring process and the employment relationship, to investigate or use in its decision-making process an employee’s or applicant’s credit information. Specifically, a covered employer is prohibited from “requiring, requesting, suggesting, or causing any employee [current or prospective] to submit credit information, and from using, accepting, referring to, or inquiring into an employee’s credit information.” “Inquiring” is defined by the Act as any method used to gather credit information, including job applications, interviews, and credit history checks. Moreover, “credit information” includes any communications regarding an applicant or employee’s creditworthiness, credit standing, credit capacity, or credit history. It is important to note that the Act is also applicable to unpaid interns. The new law applies to all employers, employment agencies, and labor organizations in the District of Columbia, with the exception of the following:

  • Job positions with financial institutions where the position involves access to personal financial information;
  • Job positions where the employer is required by D.C. law to collect credit information;
  • Some job positions within the D.C. government, such as a special police officer or a position in the office of the D.C. Chief Financial Officer;
  • Job positions that require security clearance under D.C. law; and
  • Situations in which an employer receives the credit information pursuant to a subpoena, court order, or law enforcement investigation

Similar to D.C.’s 2014 “ban-the-box” law prohibiting employers from questioning applicants about arrests, an aggrieved applicant or employee may file an administrative complaint with the D.C. Commission on Human Rights. If the Commission finds a violation, it may impose monetary penalties, which are awarded to the complainant and range from $1,000 to $5,000. Specifically, $1,000 may be awarded for the first violation, $2,500 for the second violation, and $5,000 for the third and each subsequent violation. Because the penalty is awarded to the complainant, employers should exercise extra caution – covered employees and applicants will have an incentive to file charges. As with other employment discrimination charges under the D.C. Human Rights Act, employees and applicants may also pursue a claim in court – a remedy that is not available under D.C.’s “ban-the-box” law.
http://www.lexology.com/library/detail.aspx?g=f1e1e770-e8f4-4644-866f-4f312538c843&utm_source=Lexology+Daily+Newsfeed&utm_medium=HTML+email+-+Body+-+General+section&utm_campaign=ACC+Newsstand+subscriber+daily+feed&utm_content=Lexology+Daily+Newsfeed+2017-04-12&utm_term

NM Data Breach Notification
Apr. 6: New Mexico enacted its new data breach notification law
https://www.nmlegis.gov/Legislation/Legislation?Chamber=H&LegType=B&LegNo=15&year=17

Maine Delays Implementation of Certain Provisions of Recreational Marijuana Law
Last November, Maine was one of four states in which voters approved a new recreational marijuana law. Maine’s law took effect on January 30, 2017; however, emergency legislation passed on January 27, 2017 delayed the implementation of certain provisions of the law. Specifically, the emergency legislation:

  • Delayed the effective date of most of the provisions of the law (including the anti-discrimination provisions, discussed below) until February 1, 2018, so that the state licensing authority can establish and implement regulations concerning retail sales of marijuana;
  • Clarified that possession of a usable amount of marijuana by a juvenile is a crime, unless the juvenile is authorized to possess medical marijuana; and,
  • Prohibits possession of any edible retail marijuana products until February 1, 2018.

Maine’s recreational marijuana law provides that employers are not required to permit or accommodate the use, consumption, possession, trade, display, transportation, sale, or growing or marijuana in the workplace, and also are permitted to enact and enforce workplace policies restricting the use of marijuana by employees and discipline employees who are under the influence of marijuana in the workplace. But the law prohibits employers from “refusing to employ a person solely because that person consumed marijuana outside the employer’s property.” This language is problematic for employers who conduct drug testing because a drug test does not reveal when or where someone used marijuana. It is impossible to learn from a drug test result whether marijuana was “consumed outside the employer’s property” because marijuana can stay in the human body for days or even weeks. This language will make it difficult for Maine employers to conduct drug testing for marijuana, particularly in the pre-employment context. Even if a Maine employer suspects that an employee is “under the influence of marijuana in the workplace,” the drug test result will not provide conclusive proof that the marijuana was consumed at work. The Maine legislature has formed a committee to consider implementation of the recreational marijuana law and it is hoped that the anti-discrimination language will be revised.
http://www.lexology.com/library/detail.aspx?g=b618e1e7-cc69-4d24-9012-d467c5f09129&utm_source=Lexology+Daily+Newsfeed&utm_medium=HTML+email+-+Body+-+General+section&utm_campaign=ACC+Newsstand+subscriber+daily+feed&utm_content=Lexology+Daily+Newsfeed+2017-04-13&utm_term

Proposed Changes to Massachusetts CORI Regulations
As most Massachusetts employers know, in May 2012 the legislature passed sweeping reform to the Commonwealth’s Criminal Offender Record Information (CORI) law. Shortly thereafter, the Department of Criminal Justice Information Services (DCJIS) issued regulations implementing the new law. The DCJIS recently proposed changes to those original regulations, and the final amended regulations have now been issued by the Secretary of State’s Office. While many of the revisions address non-substantive housekeeping matters, a number of changes will require employers to modify their criminal history background check process.
The following changes will have the biggest impact on employers:

  • Who is an Employee? The regulations expand the definition of employee to include not only traditional employees and volunteers, but also contractors, subcontractors, vendors, and special state, county or municipal employees. DCJIS has indicated that including contractors, sub-contractors and vendors in the definition of employee is consistent with the Criminal Record Review Board’s (CRRB) interpretation and is meant to provide employers with the authority to run background checks on individuals holding or applying for such positions. From the employers’ perspective, DCJIS has expanded the definition of employee well beyond its traditional meaning, and in a manner that is at odds with the definition of this term under other state and federal laws, leading to possible uncertainty for employers.
  • What is CORI? The prior regulations did not define “Criminal Offender Record Information,” beyond a list of examples of information included or excluded from CORI. Although the regulations now define CORI, the definition continues to leave some uncertainty as to what information, outside of that specifically provided by DCJIS, constitutes CORI. The regulations continue to exclude published records of public court, judicial or administrative proceedings from the definition of CORI. Most employers have interpreted this to mean that information obtained directly from state or federal courts (the primary source of criminal history information provided by background screening companies) is not CORI and, thus, not subject to the rules regulating the use of CORI obtained from DCJIS. Despite public comments asking for DCJIS to make this exception more explicit, it declined to do so. The regulations also now specifically exclude from the definition of CORI, information related to criminal proceedings that were initiated against an individual before he or she turned 18, unless the individual is adjudicated as an adult. Prior to the revisions, this threshold was 17. This change was part of a larger effort by the legislature to expand juvenile jurisdiction until an individual turns 18.
  • “Need to Know” List and New iCORI Agency Agreement: The revised regulations require employers to enter into an iCORI Agency Agreement prior to obtaining and/or renewing electronic access to the iCORI system. The iCORI Agency Agreement will, at a minimum, include the employer’s representation that: (1) it will comply with the CORI laws and regulations; (2) it will maintain an up to date “need to know” list of staff that the employer has authorized to request, receive or review CORI information and to provide all staff on the “need to know” list with all CORI training materials; (3) it will only request the level of CORI access authorized under statute or by the DCJIS; and (4) it (and any individual users of the employer’s iCORI account) will be liable for any violations of the CORI law or regulations. The “need to know” list provision specifically requires that employers maintain a list of employees with access to CORI, update the list, at least, every six months, and provide it to the DCJIS upon request. The DCJIS had previously included this requirement in its Model CORI Policy (available on its website), but has now codified this requirement in the regulations. The DCJIS has not yet issued the iCORI Agency Agreement, which may include additional requirements.
  • CORI Acknowledgment Forms: DCJIS has made several changes to the regulations that affect the collection, use and destruction of CORI Acknowledgment Forms.
    • The new regulations specifically permit employers to collect CORI Acknowledgment Forms electronically, including as part of an employer’s electronic job application. Although allowing electronic collection of these forms is a positive step, employers should be cautious about collecting date of birth and other demographic information required for CORI Acknowledgment Forms in the course of a job application and need to ensure that any background check forms meet the requirements of other laws including the federal Fair Credit Reporting Act.
    • The DCJIS maintains Model CORI Acknowledgment forms on its website. The new regulations contemplate that employers may either use the model forms or incorporate the language into its own form.
    • The regulations continue to require that employers verify the identity of individuals for whom they run a background check by reviewing a suitable form of government issued identification. The new regulations now specify that suitable forms of identification must contain a photograph, and that in the event that an individual does not have a suitable form of government issued identification, an employer may verify identity by reviewing either the individual’s birth certificate or social security card. To the extent that an employer cannot do this verification in person, the regulations continue to allow an individual to submit a notarized Acknowledgment Form, either in written form or electronically.
    • Under the prior regulations, employers could submit a new request for a CORI check within one year of an individual having signed the CORI Acknowledgment Form, but were required to provide the individual with written notice at least 72 hours before submitting the request. The new regulations eliminate the 72-hour notice requirement and allow employers to run an additional check provided that the employer notifies the subject on the Acknowledgment Form that a CORI check may be requested within one year. DCJIS has indicated it will revise the CORI Acknowledgment Form available on its website to reflect this change. For checks conducted after one year, employers must submit a new CORI Acknowledgment Form; however, if the information on the form exactly matches the information on the expired CORI Acknowledgement Form, an employer is not required to verify the individual’s identity a second time.
    • The new regulations clarify that in addition to destroying all CORI reports, employers must also destroy all CORI Acknowledgment Forms. The regulations also specify acceptable means of destroying hard copies and electronically stored CORI.
  • Storing CORI in the Cloud: In recognition of changing technology, DCJIS now permits employers to store CORI using cloud storage methods. DCJIS requires employers using cloud storage to have a written agreement with the provider and that the storage method provide for encryption and password protection. The regulations initially required that all cloud storage agreements be reviewed and approved by DCJIS. Following receipt of public comments, DCJIS amended the proposed regulation to remove this requirement and will instead issue guidelines regarding such cloud storage agreements and will require employers to make these agreements available to DCJIS upon request.
  • Additional Information for Pre-Adverse Action Notices: Currently, employers that contemplate adverse action against an employee because of information in a CORI report obtained through DCJIS are required to provide the subject of that report with certain information, including identifying the information in the report that is the basis for potential adverse action. Previously, the requirement to specifically identify this information did not apply to criminal history information obtained from a source other than DCJIS. The new regulations require that employers who obtain CORI identify the specific information that is the basis for the potential adverse action, even when criminal history information is obtained from a source other than DCJIS. The regulations do not seem to extend this requirement to background screening companies that are required only to identify the information in the “subject’s CORI” that is the basis for the potential adverse action. The regulations do, however, now require background screening companies to identify the source of criminal history information. The regulations also continue to require employers (assuming the employer acts as a decision-maker or has direct contact with the subject of the background check) that conduct five or more criminal background checks to maintain a background check policy and to provide of copy of the policy with pre-adverse action notifications. This is the case whether CORI is obtained from DCJIS or any other source. DCJIS has, however, limited the requirement that an employer provide DCJIS Information Concerning the Process in Correcting a Criminal Record to those instances where CORI is considered as part of a potential adverse action. Employers should review their pre-adverse action notifications to ensure they comply with these requirements.
  • Obtaining CORI from Background Screening Companies: The regulations continue to allow background screening companies to obtain CORI on behalf of employers, but maintain the restrictions on the storage of this information which led many background screening companies to cease providing CORI. Specifically, the regulations continue to prohibit background screening companies from electronically or physically storing CORI results, unless the background screening company is authorized by the employer to act as the decision maker. In practice, employers very rarely enlist background check companies to act in this capacity, and many background check companies are hesitant to take on this role. Despite public comments asking DCJIS to reconsider this restriction, the regulations continue to impose this barrier to employers that use background screening companies. Additionally, the regulations have made clear that an employer must provide a statement to the background screening company indicating whether the annual salary of the position for which the subject is being screened is either above or below $75,000.

http://www.lexology.com/library/detail.aspx?g=fd3000ba-3b2c-430f-a77e-19d40d01d153&utm_source=Lexology+Daily+Newsfeed&utm_medium=HTML+email+-+Body+-+General+section&utm_campaign=ACC+Newsstand+subscriber+daily+feed&utm_content=Lexology+Daily+Newsfeed+2017-04-20&utm_term

Utah – New Law Aims to Help Job Applicants with Criminal History
Job applicants who’ve been convicted of a crime won’t have to disclose their criminal record before some job interviews under a new Utah law aiming to help convicts find work after prison. The legislation only applies to government jobs, but supporters say they hope more private employers adopt the practice. Rep. Sandra Hollins, a social worker who sponsored the new law, said people who have served time behind bars often find it tough to become a member of the workforce again if they’re required on job applications to disclose or list criminal convictions before getting a chance to explain themselves. “You at least need to get the foot in the door,” said Hollins, D-Salt Lake City. “My goal is to have the person get into the interview based on their qualifications.” The new law, which takes effect May 9, says government employers can’t exclude someone from getting a job interview if the applicant has been convicted of a crime, and they can’t ask about a criminal record before the interview.
http://www.kansas.com/news/business/article146004334.html

International Developments

EU-U.S. Privacy Shield
On April 6th, the European Parliament passed a resolution that calls on the European Commission to conduct an assessment of the EU-U.S. Privacy Shield Agreement. The assessment is intended to ensure that EU citizens’ personally identifiable information which is transferred for commercial purposes is adequately protected according to the EU Charter of Fundamental Rights and new EU data protection rules. The European Parliament is specifically concerned about:

  • The recent repeal of the FCC’s broadband privacy rules requiring providers to obtain consumers’ consent before sharing their personal information;
  • The lack of effective judicial redress rights for EU individuals whose data is transferred to the U.S.; and
  • New rules that allow the National Security Agency to share large amounts of private data without a warrant, court order, or congressional authority with 16 other federal agencies.

http://www.europarl.europa.eu/news/en/news-room/20170329IPR69067/data-privacy-shield-meps-alarmed-at-undermining-of-privacy-safeguards-in-the-us

Swiss-U.S. Privacy Shield Framework
Swiss-U.S. Privacy Shield FAQs is available at: https://www.privacyshield.gov/Swiss-US-Privacy-Shield-FAQs

Data Anonymization and Pseudonymization
On April 25th, IAPP published an article about data anonymization and pseudonymization when organizations are complying with the EU’s General Data Protection Regulation (GDPR). Anonymized data is “data rendered anonymous in such a way that the data subject is not or no longer identifiable” while pseudonymized data is data that “can no longer be attributed to a specific data subject without the use of additional information.” According to the article, under the GDPR, both techniques would permit data controllers and processors to use individuals’ personal data more freely, with significantly less risk of noncompliance and more relaxed standards. As a result, data controllers and processors would be able to use personal information in more innovative ways. Currently, EU’s Article 29 Working Party has yet to release guidance regarding anonymization and pseudonymization techniques.
https://iapp.org/news/a/looking-to-comply-with-gdpr-heres-a-primer-on-anonymization-and-pseudonymization/

Please Note: Some of the information contained herein is a monthly summary of the daily information provided by Arnall Golden Gregory LLP, an Atlanta firm servicing the business transactions and litigation needs of background check companies. The information described is general in nature, and may not apply to your specific situation. Legal advice should be sought before taking action based on the information contained herein. For more information about Arnall Golden Gregory LLP, please visit www.agg.com or contact Bob Belair at 202.496.3445 or robert.belair@agg.com.